Security Idenitity 2.0 Email Confirmation Token Create with one account validate with a different account

Question

Howdy,
I extended the security model and made it multi-tenant, however when I create a email confirmation token in the admin tool, when I try and validate it, in one of the applications, it fails.  In the admin tool, I create a UserManager with all of
the settings as if it were the application, but when the validation occures in the application it still fails.  The only way I can get it to work, is if I use the same app pool for both the application and the admin, or if I set the user account of both
app Pools to the same service account.  How can I get it to work where I create a token in one app, and validate in another app?  Could I use impersonation?  Is there something I can do to the two service accounts to allow one to generate
a token and the other to validate?

Answer 1

Let's see if I can answer these in order...
1.  We built several web applications using MVC 5.2, EF 6.0, Idenity 2.0
2.  We are using MS Visual Studio 2013, running on VM with Windows Server 2008 R2, .NET 4.5.1
3.  The problem is we want to have each application have a different service account to make them more secure.  We have an admin tool that allows us to add new applications to the Membership database, and new users to those applications.  The
problem occurs when I create an email security token in the admin tool, and send it to the use who is then validated on the specific application.  If I make the service account of the application and the admin the same it works, if not it fails.
I don't think the code is the problem, as it works fine if the service account for the application and the admin are the same.  It only fails when I use seperate service accounts, but here you go.
Admin snippet:
Manage Controller - RegisterUser
varuser =
newApplicationUser()
{ UserName = model.UserName, Email = model.Email, IsActive = model.SelectedIsActive, IsPswdChgRequired = model.SelectedIsPswdChgRequired, TenantId = model.TenantId };
UserManager<ApplicationUser,
int> um = CreateUserManager(Convert.ToInt32(model.SelectedTenantId));
private UserManager<ApplicationUser, int> CreateUserManager(int TenantId)
            var provider = new Microsoft.Owin.Security.DataProtection.DpapiDataProtectionProvider(GetTenantName(TenantId));
            UserManager<ApplicationUser, int> um = new UserManager<ApplicationUser, int>(new ApplicatonUserStore(new ApplicationDbContext()) { TenantId = TenantId });
            um.UserTokenProvider = new Microsoft.AspNet.Identity.Owin.DataProtectorTokenProvider<ApplicationUser, int>(provider.Create("EmailConfirmation"));
Application snippet:
AccountController - constructor
var
provider =
newMicrosoft.Owin.Security.DataProtection.DpapiDataProtectionProvider(ConfigurationManager.AppSettings["TenantName"]);
            userManager.UserTokenProvider =
newMicrosoft.AspNet.Identity.Owin.DataProtectorTokenProvider<ApplicationUser,
int>(provider.Create("EmailConfirmation"));
public async Task<ActionResult> ConfirmEmail(string userId, string ecode, string scode)
            if (userId == null || ecode == null || scode == null)
                return View("Error");
            var result = await UserManager.ConfirmEmailAsync(Convert.ToInt32(userId), ecode);
            if (result.Succeeded)